Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\CLSID\{00000000-0000-0000-0000-100000000001}\shell\Open\Command] '' = '"%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE" www.97796.cn/?win7'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\IEDATA.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\360SE\stat.ini
- %APPDATA%\360SE\extensions\ExtChongzhi\stat.ini
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_07_26.log
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_07_23.log
- %APPDATA%\360SE\extensions\SafeCentral\sc.ini
- %APPDATA%\360SE\extensions\ExtProxy\proxy.ini
- %APPDATA%\Tencent\TencentTraveler\100\NewMostVisitInfo.ini
- %APPDATA%\360SE\extensions\SafeCentral\SafeCentral.ini
- %APPDATA%\360SE\extensions\ExtAddons\recommend.ini
- %TEMP%\aut6.tmp
- %HOMEPATH%\Favorites\深度系统下载.url
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_08_04.log
- %APPDATA%\SogouExplorer\SEacc_refresh_pattern.txt
- %APPDATA%\Tencent\TencentTraveler\100\ttproxy.pac
- %TEMP%\aut7.tmp
- %HOMEPATH%\Favorites\2548绿色网址导航.url
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_07_27.log
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_08_03.log
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_08_01.log
- %APPDATA%\360SE\data\ico\yahoo.cn.ico
- %APPDATA%\360SE\data\ico\wxfy.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\zqjl.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\zhidao.baidu.com.ico
- %APPDATA%\360SE\data\ico\www.youdao.com.ico
- %APPDATA%\360SE\data\ico\www.sohu.com.ico
- %APPDATA%\360SE\data\ico\www.sogou.com.ico
- %APPDATA%\Tencent\TencentTraveler\100\favicon\www.soso.com_favicon.ico
- %APPDATA%\360SE\data\ico\www.soso.com.ico
- %APPDATA%\360SE\360SE.ini
- %APPDATA%\360SE\extensions\ExtAddons\ExtStats.ini
- %APPDATA%\360SE\extensions\ExtDoctor\ExtDoctor.ini
- %APPDATA%\360SE\extensions\ExtAddons\ganzhi.ini
- %APPDATA%\360SE\extensions\Favorites\Favorites.ini
- %APPDATA%\360SE\extensions\ExtAdfilter\extadfilter.ini
- %APPDATA%\Tencent\TencentTraveler\Data.ini
- %APPDATA%\Tencent\TencentTraveler\Config.ini
- %APPDATA%\360SE\extensions\ExtAddons\ExtAddons.ini
- %APPDATA%\360SE\extensions\SafeCentral\esimple.ini
- %HOMEPATH%\Favorites\淘宝网 - 淘！我喜欢.url
- %TEMP%\aut11.tmp
- %HOMEPATH%\Favorites\三国英雄.url
- %TEMP%\aut12.tmp
- %HOMEPATH%\Favorites\QQ个性搞笑表情下载 - 猫猫表情站.url
- %TEMP%\autF.tmp
- %HOMEPATH%\Favorites\斗蟹软件站.url
- %TEMP%\aut10.tmp
- %HOMEPATH%\Favorites\主题之家 - 主题下载.url
- %TEMP%\aut13.tmp
- %HOMEPATH%\Favorites\绿色下载.url
- %TEMP%\aut16.tmp
- %APPDATA%\win7start.reg
- %TEMP%\aut17.tmp
- %HOMEPATH%\Favorites\豆豆网.url
- %TEMP%\aut14.tmp
- %HOMEPATH%\Favorites\萝卜软件站 - 绿色软件下载站.url
- %TEMP%\aut15.tmp
- %HOMEPATH%\Favorites\百货网.url
- %APPDATA%\360SE\extensions\ExtDoctor\doctor.dll
- %APPDATA%\SogouExplorer\Openpage.xml
- %TEMP%\7ZSfx000.cmd
- %TEMP%\aut9.tmp
- %HOMEPATH%\Favorites\最新XP系统免费下载.url
- %TEMP%\aut8.tmp
- %APPDATA%\SogouExplorer\CommCfg.xml
- %APPDATA%\SogouExplorer\configlocal.xml
- %APPDATA%\SogouExplorer\Config.xml
- %HOMEPATH%\Favorites\电脑装机必备软件.url
- %TEMP%\autD.tmp
- %HOMEPATH%\Favorites\热门单机游戏下载.url
- %TEMP%\autE.tmp
- %HOMEPATH%\Favorites\windows7系统下载.url
- %TEMP%\autC.tmp
- %HOMEPATH%\Favorites\雨林木风系统下载.url
- %TEMP%\autA.tmp
- %HOMEPATH%\Favorites\4399小游戏,单人游戏,双人游戏.url
- %TEMP%\autB.tmp
- %APPDATA%\360SE\extensions\SafeCentral\urllibauth.dat
- %APPDATA%\360SE\extensions\SafeCentral\urllib.dat
- %APPDATA%\360SE\data\360sefav.db
- %APPDATA%\360SE\data\user.dat
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat
- %APPDATA%\SogouExplorer\FormData.dat
- %APPDATA%\SogouExplorer\Favorite2.dat
- %APPDATA%\360SE\extensions\SafeCentral\SafeProtect.dat
- %APPDATA%\360SE\data\history.dat
- %APPDATA%\SogouExplorer\MCPattern.db
- %APPDATA%\Tencent\TencentTraveler\100\RecommandUrls.html
- %APPDATA%\360SE\data\DailyBackup\360sefav_2010_08_04.favdb
- %APPDATA%\360SE\data\ico\baike.baidu.com.ico
- %APPDATA%\360SE\data\ico\avc.360.cn.ico
- %APPDATA%\360SE\data\DailyBackup\360sefav_2010_07_23.favdb
- %APPDATA%\Tencent\TencentTraveler\100\navinfo.db
- %APPDATA%\SogouExplorer\Misc.db
- %APPDATA%\SogouExplorer\UserId.enc
- %APPDATA%\SogouExplorer\uhistory.db
- %TEMP%\aut4.tmp
- <SYSTEM32>\bhw.ico
- %TEMP%\aut5.tmp
- %TEMP%\IEDATA.exe
- %TEMP%\aut3.tmp
- <SYSTEM32>\tbw.ico
- %TEMP%\aut1.tmp
- <SYSTEM32>\favicon.ico
- %TEMP%\aut2.tmp
- %WINDIR%\一键清理win7系统垃圾.bat
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat.bak
- %APPDATA%\SogouExplorer\Webkit\VisitedLinks
- %APPDATA%\SogouExplorer\adbdata.dat
- %APPDATA%\360SE\extensions\ExtAddons\ExtStats.ini.cfg
- %APPDATA%\SogouExplorer\videopattern
- %APPDATA%\SogouExplorer\abw
- %ALLUSERSPROFILE%\Start Menu\Programs\一键清理win7系统垃圾.bat
- %APPDATA%\SogouExplorer\dew
- %APPDATA%\SogouExplorer\Webkit\Cookies
- %APPDATA%\360SE\data\ico\shihb.blog.sohu.com.ico
- %APPDATA%\360SE\data\ico\search8.taobao.com.ico
- %APPDATA%\360SE\data\ico\translate.google.com.hk.ico
- %APPDATA%\360SE\data\ico\t.sohu.com.ico
- %APPDATA%\360SE\data\ico\se.360.cn.ico
- %APPDATA%\360SE\data\ico\niudaowenhua.blog.sohu.com.ico
- %APPDATA%\360SE\data\ico\news.sohu.com.ico
- %APPDATA%\360SE\data\ico\poker.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\plsm.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\wan.360.cn.ico
- %APPDATA%\360SE\data\ico\www.kappa.com.cn.ico
- %APPDATA%\360SE\data\ico\www.google.com.hk.ico
- %APPDATA%\360SE\data\ico\www.sina.com.cn.ico
- %APPDATA%\360SE\data\ico\www.qihoo.com.ico
- %APPDATA%\360SE\data\ico\www.ghost2.cn.ico
- %APPDATA%\Tencent\TencentTraveler\100\favicon\www.2548.cn_favicon.ico
- %APPDATA%\360SE\data\ico\www.2548.cn.ico
- %APPDATA%\360SE\data\ico\www.donews.com.ico
- %APPDATA%\360SE\data\ico\www.baidu.com.ico
- %APPDATA%\360SE\data\ico\dh.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\dgcs.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\finance.sina.com.cn.ico
- %APPDATA%\360SE\data\ico\farm.wan.360.cn.ico
- %APPDATA%\SogouExplorer\FavIcon\default_page.ico
- %APPDATA%\360SE\data\ico\cn.bing.com.ico
- %APPDATA%\360SE\data\ico\biz.finance.sina.com.cn.ico
- %APPDATA%\360SE\data\ico\ddt.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\cz.360.cn.ico
- %APPDATA%\360SE\data\ico\free.donews.com.ico
- %APPDATA%\360SE\data\ico\mcsd.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\ks.cn.yahoo.com.ico
- %APPDATA%\360SE\data\ico\money.finance.sina.com.cn.ico
- %APPDATA%\360SE\data\ico\me.360.cn.ico
- %APPDATA%\SogouExplorer\FavIcon\http_www.97796.cn_80_fav.ico
- %APPDATA%\360SE\data\ico\hero.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\hao.360.cn.ico
- %APPDATA%\SogouExplorer\FavIcon\http_www.2548.cn_80_fav.ico
- %APPDATA%\SogouExplorer\FavIcon\http_ie.sogou.com_80_fav.ico
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\SogouExplorer\UserId.enc
Удаляет следующие файлы:
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut13.tmp
- %TEMP%\autE.tmp
- %TEMP%\autF.tmp
- %TEMP%\aut10.tmp
- %TEMP%\aut17.tmp
- %TEMP%\IEDATA.exe
- %TEMP%\7ZSfx000.cmd
- %TEMP%\aut14.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut16.tmp
- %TEMP%\autD.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\autA.tmp
- %TEMP%\autB.tmp
- %TEMP%\autC.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
Самоудаляется.
